Checkmarx One DAST v2 UAI Connector

The Checkmarx One DAST v2 (Dynamic Application Security Testing)  UAI connector integrates with the Checkmarx One platform to ingest application security findings into Qualys Enterprise TruRisk Management (ETM). By simulating real-world attack scenarios against running web applications, Checkmarx One – DAST identifies vulnerabilities. The Qualys connector enables you to centralize these findings in ETM, allowing for risk visualization, prioritization, and remediation efforts through TruRisk Insights.

This connector can be activated for your subscription only after UAI is activated on your account. Once activated, you can proceed with configuring the connection.

Connector Details

Vendor	Checkmarx
Product Name	Checkmarx
Category	Application Security
Findings Supported	Web Applications and Vulnerabilities (Findings)
Assets Supported	WebApplications
Version	1.0.0
Supported Version & Type	SaaS (Latest)
Integration Type	API Integration (REST)
Direction	Unidirectional  (Checkmarx to Qualys)
Delta Support	Not Supported
Import of Installed Software	Not Supported
Import of Source Tags	Not Supported
Filters/Filter Query	Not Supported

Authentication

Name	Key	Type	Description
Checkmarx Region	checkmarxRegion	String	Example: deu Region can be retrieved from the base URL of Checkmarx One environment. Example: https://deu.ast.checkmarx.net
Tenant Name	tenantName	String	Tenant ID for the user profile.
API Key	api_key	String	API Key for the user profile

Setting Up API Key

Reference: Creating OAuth Clients – Checkmarx Docs

1. Log in to your Checkmarx One environment (choose the appropriate server base URL).
   Checkmarx One Server Base URLs:US Environment - https://ast.checkmarx.net
   1. US2 Environment - https://us.ast.checkmarx.net
   2. EU Environment - https://eu.ast.checkmarx.net
   3. EU2 Environment - https://eu-2.ast.checkmarx.net
   4. DEU Environment - https://deu.ast.checkmarx.net
   5. Australia & New Zealand – https://anz.ast.checkmarx.net
   6. India - https://ind.ast.checkmarx.net
   7. Singapore - https://sng.ast.checkmarx.net
   8. UAE - https://mea.ast.checkmarx.net
   9. Israel (gov) - https://gov-il.ast.checkmarx.net

2. Navigate to Settings > Identity and Access Management.

3. In the main navigation, click API Keys > Create Key.

4. Configure the API Key with an optional Note description, the expiration period of the key, and the notification email(s).

5. Click Create and copy the API Key. Store it securely for later use.

Required Permissions:

Entity Type	Permissions
VulnerabilityFindings	read: vulnerabilities

API Endpoints

Name	Endpoint	Example
Authorization API	https://<domain>.checkmarx.net/auth/realms/ <tenantId> /protocol/openid-connect/token	Grant Type: client_credentials
Fetch Environment	https://<domain>.checkmarx.net/api/dast /scans/environments/	Example Domain: deu.ast
Fetch Scans	https://<domain>.checkmarx.net/api/dast /scans/scans?environmentId=<environmentId>	Example Environment ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Fetch Scan Details	https://<domain>.checkmarx.net/api/dast/mfe-results/results/<scanId>	Example Scan ID: xxxxxxxx-xxxx-xxxx-xxxx- xxxxxxxxxxxx

Configure Checkmarx DAST UAI Connector

Basic Details

Provide the following details

1. Connector Name and Description
2. Authentication details (Checkmarx Region, Tenant Name, API Key)

 

Profile

Profiles control the execution of the connector.

1. Provide a Name and Description.
2. Set Status (Active or Inactive).
3. Configure a Schedule: Single Occurrence or Recurring with start and end dates/times.
4. Assets value will be "APPLICATION" by default for Checkmarx DAST UAI connector
5. Click Next.

How Does the Connection Work?

On schedule (or on-demand), the connector fetches Checkmarx One findings and imports them into ETM. Profiles define what is synchronized and when. The Checkmarx DAST - UAI connector performs a full pull on each execution.

In the Connector screen, you can find your newly configured connector listed and marked in the Processed state.

Connector States

A successfully configured connector goes through 4 states.

1. Registered - The connector is successfully created and registered to fetch data from the vendor.
2. Scheduled - The connector is scheduled to execute a connection with the vendor.
3. Processing - A connection is executed and the connector is fetching the asset and findings data.
4. Processed - The connector has successfully fetched the assets, it may still be under process of fetching the findings. Wait for some more time for the connector to fetch the findings completely.

The Processed state indicates that the Connector is successfully configured but it is under the process of importing all your assets and findings. This process (specifically for findings) may take some time.

This entire process may take up to 2 hours for completion. Once it is done, you can find the imported data in Enterprise TruRisk Management (ETM).

Viewing Assets and Findings in ETM

1. Navigate to Enterprise TruRisk Management > Inventory.
   • Go to Assets > Applications > Web Applications to view imported Checkmarx applications.
     
2. Navigate to Risk Management > Findings > Vulnerability.
   • Use filter: finding.vendorProductName:"Checkmarx" to list Checkmarx findings.
     

Activating Web Applications in WAS

Web applications synced from the Checkmarx DAST - UAI Connector appear in:

• ETM
• CSAM
• WAS 

By default, these applications are not activated for scanning in WAS.

To activate web applications in WAS

1. Navigate to CSAM > Web Applications.
2. Select the desired web application.
3. Choose Quick Actions > Activate WAS.

- Activating web applications consumes WAS licenses. You should activate only the required applications.
- This connector fetches the latest scans for the Web Applications. 

Checkmarx DAST - UAI Transformation Map

The default transformation map configured for the Checkmarx DAST–UAI connector is fetched from the database and utilized during the execution of the connector profile to perform data transformation.

Source Field	Target Field
created	sourceCreatedAt
environmentId	externalAssetId
environmentId	vendorAssetId
domain	asset.name
url	baseUrl
environmentId	applicationEnvironment
hasAuth	authenticationEnabled
scanResults[].id	externalFindingId
scanResults[].name	findings[].name
scanResults[].severity	findings[].severity
scanResults[].status	findingStatus
scanResults[].description	findings[].description
scanResults[].solution	solutionRecommendation
scanResults[].cwe_id	cweId
scanResults[].owasp[]	vulnerability.owaspTop10Ids[].name
scanResults[].url	findingURL
environmentScans[].scanType	detectionMethod